Enable limited trust chaining

In HK we discussed adding support for limited trust chaining, such that a user may authorize a service to delegate on their behalf, via a decrementing counter (where the default would still be no chaining of delegation)